Home / The record / Existing mechanisms changed
6.5.2
SDSA: three sizes, one strength rule
The SDSA parameter paragraph is replaced. Three sizes are permitted for the main parameter, the hash size and the other parameter follow the security-level table, the hash strength must be at least the second parameter, and the hash comes from the main hash part. The lightweight part is not named here.
- What it asks
- Record for each SDSA deployment the main parameter size, the two derived values and the hash. Show that the hash strength is at least the second value, and show that the hash comes from the part the clause names. The difference from KCDSA is deliberate and should be visible in the approved list.
- What the amendment does
- Replaces the paragraph under the listing in 6.5.2. So the 2018 wording is superseded for this clause.
- Who it binds
- The owner of each SDSA deployment, with the cryptography reviewer.
- Evidence an auditor samples
- The SDSA parameter record, naming the main size and the derived values (configuration)
- The approved hash list, showing which part each hash belongs to (cryptography standard)
- The test that rejects a hash below the second value (test suite)
- The test you can run
- Ask which hash part the SDSA deployment draws on. If the answer is the lightweight part, the clause does not permit it and the finding is recorded.
- Common failures
- The three sizes are treated as a recommendation and other sizes are used.
- The hash rule is copied from the KCDSA row.
- How to close it
- Two mechanisms that look alike in the policy have different hash rules. Keep them on separate rows, with the clause citation on each, so that a reviewer cannot apply one rule to both by accident. Start with the SDSA parameter record, naming the main size and the derived values and let the row close when it exists with a date and a named holder.
- Where it sits against the base standard
- The base standard carries an earlier version of 6.5.2, and the amendment replaces the paragraph named above. A citation to the base edition alone points at wording that no longer applies, which is the defect this record exists to catch.